Heap Overflow Vulnerability in libheif Image Decoder

CVE-2026-84383

What is CVE-2026-84383?

The vulnerability in libheif, versions prior to 1.23.2, arises from a failure to properly handle crafted HEIF, HEIC, or AVIF item graphs containing nested iden and auxl references. This flaw allows an attacker to trigger a heap out-of-bounds write by exploiting the improper handling of Alpha planes during image decoding. Specifically, the method HeifPixelImage::transfer_channel_from_image_as() may result in duplicate Alpha planes with varying bit depths, leading to erroneous memory allocation and potential exploitation when the heif_decode_image() function processes maliciously constructed files.

References